<HTML dir=ltr><HEAD> <META content="text/html; charset=unicode" http-equiv=Content-Type> <META name=GENERATOR content="MSHTML 8.00.7601.17824"> <STYLE></STYLE> </HEAD> <BODY> <DIV dir=ltr id=idOWAReplyText52773> <DIV dir=ltr><FONT color=#000000 size=2 face=Arial>Are you using OpenLDAP to connect to MS AD servers?</FONT></DIV> <DIV dir=ltr><FONT color=#000000 size=2 face=Arial></FONT> </DIV></DIV> <DIV dir=ltr id=idSignature1982> <DIV RE> <DIV><FONT size=2 face=Arial>Tom Saunders | SAIC<BR>Senior Information Assurance & Security Engineer<BR>phone: 540-653-0986 | fax 540-663-0640</FONT></DIV> <DIV><FONT size=2 face=Arial>mobile: 540-408-3087| email: </FONT><A href="mailto:SaundersT@saic.com"><FONT size=2 face=Arial>SaundersT@saic.com</FONT></A><FONT size=2 face=Arial> <BR>SIPRnet: </FONT><A href="mailto:Thomas.D.Saunders@us.army.smil.mil"><FONT size=2 face=Arial>Thomas.D.Saunders@us.army.smil.mil</FONT></A> <DIV style="MARGIN: 0in 0in 0pt" class=MsoPlainText><SPAN style="mso-no-proof: yes"><FONT face=Arial><FONT size=2>SIPRnet: </FONT><A href="mailto:Thomas.Saunders@navy.smil.mil"><FONT size=2>Thomas.Saunders@navy.smil.mil</FONT></A><FONT size=2> <?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></FONT></FONT></SPAN></DIV></DIV> <DIV><FONT size=2 face=Arial></FONT> </DIV> <DIV><FONT size=2 face=Arial>Science Applications International Corporation<BR>SAIC<BR>16442 Commerce Drive<BR>King George, VA 22485<BR><BR></FONT><A href="http://www.saic.com/"><FONT size=2 face=Arial>www.saic.com</FONT></A></DIV> <DIV> </DIV></DIV></DIV> <DIV dir=ltr><BR> <HR tabIndex=-1> <FONT size=2 face=Tahoma><B>From:</B> linux-audit-bounces@redhat.com on behalf of Harris, Todd<BR><B>Sent:</B> Tue 7/31/2012 3:06 PM<BR><B>To:</B> linux-audit@redhat.com<BR><B>Subject:</B> missing user name<BR></FONT><BR></DIV> <DIV><FONT size=2 face="Calibri, sans-serif"> <DIV>I’m looking at a problem that has me really scratching my head.</DIV> <DIV> </DIV> <DIV>I’ve got a rhel 5.4 system that’s using likewise and active directory to authenticate users, at least ones that are not defined locally. Locally defined users work just fine, but any user that is defined in the active directory server is showing up in events as “unknown(uid)” the uid appears to be filled out correctly, and if the user is defined locally as well as in active directory it works just fine, but that kind of defeats the purpose. Also failed logins are showing up correctly, but I can’t figure out what they have done to their system to cause this. Can anyone give me a little direction on where I should look to determine what’s actually going on. I haven’t been able to determine how the system actually resolves the user names.</DIV> <DIV> </DIV> <DIV>Don’t know if this is important but we are using the prelude plugin and where we notice the discrepancy is in the output from the prelude-manager, I have not looked to see if it’s wrong in the aureords.</DIV> <DIV> </DIV> <DIV><FONT size=2 face="Arial, sans-serif">_______________________________</FONT></DIV> <DIV><FONT size=2 face="Arial, sans-serif">Todd Harris</FONT></DIV> <DIV><FONT size=2 face="Arial, sans-serif">Progeny Systems</FONT></DIV> <DIV><FONT size=2 face="Arial, sans-serif">Office Number: 703-368-6107 ext517</FONT></DIV> <DIV> </DIV> <DIV> </DIV></FONT></DIV></BODY></HTML>